xlkvbmfh.dll

Welcome to Major Geeks!

Please disable Spybot's Teatimer as requested in the READ & RUN ME. See: How to disable Spybot's TeaTimer Do this now before doing the below.

Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {197BCFE8-9249-4E99-B12C-80F49D25975C} - C:\Users\Steve\AppData\Local\Temp\nnNFVNEU.dll (file missing)
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [68b00bb5] rundll32.exe "C:\Users\Steve\AppData\Local\Temp\xlkvbmfh.dll",b
O4 - HKCU\..\Run: [68b00bb5] rundll32.exe "C:\Users\Steve\AppData\Local\Temp\xlkvbmfh.dll",b

After clicking Fix, exit HJT.
Now reboot your PC!

After reboot, run the C:\MGtools\GetLogs.bat file by double clicking on it.

Then attach the below log:

• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

You need to run GetLogs.bat again and allow it to finished running. Your logs were mostly old logs. Also right click on GetLogs.bat and select Run As Administrator to make sure that was not the reason logs were incomplete. I just want to be sure that everything was removed.

 

That is still an incomplete log!

Are you waiting until it finishes running as instructed in the Using MGtools link from the READ ME?
Do you have UAC disabled?
Are you running it as administrator?
Are you seeing any error messages?

 

That's better. Your logs are clean.


If you are not having any other malware problems, it is time to do our final steps:

2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop & renamed it like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\cf" /u
     • Notes: The space between the cf" and the /u, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
   • Delete the C:\cf folder from combofix.
3. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
4. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
5. If you are running Windows XP or Windows ME, do the below:
   • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
6. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!

 

You're welcome. Surf safely!